@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/propagation/install/string/substring.test.js

@@ -0,0 +1,238 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation string substring', function () {
+  let core, tracker, trackString, simulateRequestScope;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+
+    core.assess.dataflow.propagation.stringInstrumentation.substring.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.stringInstrumentation.substring.uninstall();
+    sinon.resetHistory();
+  });
+
+  [
+    {
+      desc: 'below',
+      str: 'xx-----',
+      tags: {
+        untrusted: [0, 1]
+      },
+      args: [2],
+      expectedResult: '-----',
+    },
+    {
+      desc: 'above',
+      str: '-----xx',
+      tags: {
+        untrusted: [5, 6]
+      },
+      args: [0, 3],
+      result: '---',
+    },
+    {
+      desc: 'highspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [1, 3],
+      expected: {
+        untrusted: [1, 2]
+      },
+      expectedResult: '-xx',
+    },
+    {
+      desc: 'within',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [1],
+      expected: {
+        untrusted: [1, 3]
+      },
+      result: '-xxx--',
+    },
+    {
+      desc: 'fullSpan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [2, 2],
+      expected: {
+        untrusted: [0, 1]
+      },
+      result: 'xx',
+    },
+    {
+      desc: 'lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [3, 3],
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+  ].forEach(({ desc, str, tags, args, expected }) => {
+    it(desc, function () {
+      simulateRequestScope(function () {
+        const extern = trackString(str, { tags });
+        const result = extern.substr(...args);
+        const strInfo = tracker.getData(result);
+
+        if (expected) {
+          expect(strInfo.tags).to.deep.equal(expected);
+        } else {
+          expect(strInfo).to.be.null;
+        }
+      });
+    });
+  });
+
+  [
+    {
+      desc: 'not tracked',
+      str: '-----------',
+      args: [0, 2],
+    },
+    {
+      desc: 'below',
+      str: 'xx-----',
+      tags: {
+        untrusted: [0, 1]
+      },
+      args: [2],
+    },
+    {
+      desc: 'above',
+      str: '-----xx',
+      tags: {
+        untrusted: [5, 6]
+      },
+      args: [0, 3],
+    },
+    {
+      desc: 'highspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: {
+        substring: [1, 3],
+        substr: [1, 2],
+      },
+      expected: {
+        untrusted: [1, 1]
+      },
+    },
+    {
+      desc: 'within',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [1],
+      expected: {
+        untrusted: [1, 3]
+      },
+    },
+    {
+      desc: 'fullSpan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: {
+        substring: [2, 4],
+        substr: [2, 2],
+      },
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+    {
+      desc: 'lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [3, 6],
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+    {
+      desc: 'lowspan',
+      str: 'xxx--xx',
+      tags: {
+        untrusted: [0, 2, 5, 6]
+      },
+      args: {
+        substring: [3, 1], // reversed work the same
+        substr: [1, 3], // but not for substr method
+      },
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+  ].forEach(({ desc, str, tags, args, expected }) => {
+    ['substring', 'substr'].forEach((method) => {
+      it(`${method} ${desc}`, function () {
+        simulateRequestScope(function () {
+          const extern = desc !== 'not tracked' ? trackString(str, { tags }) : str;
+          const methodArgs = args[method] || args;
+          const result = extern[method](...methodArgs);
+          const strInfo = tracker.getData(result);
+
+          if (expected) {
+            expect(strInfo.tags).to.deep.equal(expected);
+          } else {
+            expect(strInfo).to.be.null;
+          }
+        });
+      });
+    });
+  });
+
+  it('won\'t do anything if the result is the same or not in proper scope', function () {
+    const extern = trackString('foo');
+
+    let result;
+
+    core.scopes.sources.run({}, function () {
+      result = extern.substring(5);
+    });
+
+    expect(tracker.getData(result)).to.be.null;
+
+    core.scopes.sources.run(null, function () {
+      result = extern.substr(0, 2);
+    });
+
+    expect(tracker.getData(result)).to.be.null;
+
+    core.scopes.instrumentation.run({ lock: true }, function () {
+      core.scopes.sources.run({}, function () {
+        result = extern.substring(0, 2);
+      });
+    });
+
+    expect(tracker.getData(result)).to.be.null;
+  });
+});

package/lib/dataflow/propagation/install/string/trim.test.js

@@ -0,0 +1,122 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation string trim', function () {
+  let core, tracker, trackString, simulateRequestScope;
+
+  beforeEach(function () {
+    ({
+      core,
+      trackString,
+      simulateRequestScope,
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.stringInstrumentation.trim.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.stringInstrumentation.trim.uninstall();
+    sinon.resetHistory();
+  });
+
+  [
+    {
+      str: 'not-tracked',
+      expected: {
+        trim: undefined,
+        trimStart: undefined,
+        trimEnd: undefined,
+      }
+    },
+    {
+      str: '  foo  ',
+      tags: {},
+      expected: {
+        trim: undefined,
+        trimStart: undefined,
+        trimEnd: undefined,
+      }
+    },
+    {
+      str: '  foo  ',
+      tags: {
+        untrusted: [0, 6]
+      },
+      expected: {
+        trim: { untrusted: [0, 2] },
+        trimStart: { untrusted: [0, 4] },
+        trimEnd: { untrusted: [0, 4] },
+      }
+    },
+    {
+      str: '  foo',
+      tags: {
+        untrusted: [0, 4]
+      },
+      expected: {
+        trim: { untrusted: [0, 2] },
+        trimStart: { untrusted: [0, 2] },
+        trimEnd: { untrusted: [0, 4] },
+      }
+    },
+    {
+      str: 'foo  ',
+      tags: {
+        untrusted: [0, 4]
+      },
+      expected: {
+        trim: { untrusted: [0, 2] },
+        trimStart: { untrusted: [0, 4] },
+        trimEnd: { untrusted: [0, 2] },
+      }
+    },
+    {
+      str: '  foo  ',
+      tags: {
+        untrusted: [2, 4]
+      },
+      expected: {
+        trim: { untrusted: [0, 2] },
+        trimStart: { untrusted: [0, 2] },
+        trimEnd: { untrusted: [2, 4] },
+      }
+    },
+  ].forEach(({ str, tags, expected = null }) => {
+    [
+      'trim',
+      'trimStart',
+      'trimEnd',
+    ].forEach((method) => {
+      it(method, function () {
+        simulateRequestScope(function () {
+          const extern = str !== 'not-tracked' ? trackString(str, { tags }) : str;
+          const result = extern[method]();
+          expect(tracker.getData(result)?.tags).to.deep.equal(expected[method]);
+        });
+
+      });
+    });
+  });
+
+  it('won\'t do anything if not in proper scope', function () {
+    let result;
+    const extern = trackString('  foo', { tags: { untrusted: [0, 2] } });
+
+    core.scopes.sources.run(null, function () {
+      expect(tracker.getData(extern.trim())).to.be.null;
+    });
+
+
+    core.scopes.instrumentation.run({ lock: true }, function () {
+      core.scopes.sources.run({}, function () {
+        expect(tracker.getData(extern.trim())).to.be.null;
+      });
+    });
+
+    expect(tracker.getData(result)).to.be.null;
+  });
+});

package/lib/dataflow/propagation/install/unescape.test.js

@@ -0,0 +1,78 @@
+
+'use strict';
+
+const {
+  DataflowTag: { UNTRUSTED, WEAK_URL_ENCODED }
+} = require('@contrast/common');
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation unescape', function () {
+  let core, trackString, simulateRequestScope, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.unescape.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.unescape.uninstall();
+    sinon.resetHistory();
+  });
+
+  [
+    {
+      str: '%3Ftest%3Dstr',
+      tags: {
+        [UNTRUSTED]: [0, 12],
+        [WEAK_URL_ENCODED]: [0, 12]
+      },
+      expected: { [UNTRUSTED]: [0, 8] }
+    },
+    {
+      str: '?test=str',
+      tags: {
+        [UNTRUSTED]: [0, 8]
+      },
+      expected: { [UNTRUSTED]: [0, 8] }
+    },
+    {
+      str: 'not-tracked',
+    }
+  ].forEach(({ str, tags, expected }) => {
+    it('propagates correctly', function () {
+      simulateRequestScope(function () {
+        const value = tags ? trackString(str, { tags }) : str;
+
+        const result = unescape(value);
+        const strInfo = tracker.getData(result);
+        expect(strInfo?.tags).to.deep.equal(expected);
+      });
+    });
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('%3Ftest%3Dstr');
+      const result = unescape(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('%3Ftest%3Dstr');
+        const result = unescape(value);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/url/domain-parsers.test.js

@@ -0,0 +1,63 @@
+'use strict';
+
+const url = require('url');
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation url domain-parsers', function () {
+  let core, trackString, simulateRequestScope, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.urlInstrumentation.domainParsers.install();
+    core.depHooks.resolve.yield(url);
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  ['domainToASCII', 'domainToUnicode'].forEach((method) => {
+    it(method, function () {
+      simulateRequestScope(function () {
+        const notTrackedValue = 'español.com';
+        const trackedValue = trackString('español.com', { tags: { untrusted: [0, 2] } });
+
+        const notTrackedResult = url[method](notTrackedValue);
+        const notTrackedStrInfo = tracker.getData(notTrackedResult);
+
+        const trackedResult = url[method](trackedValue);
+        const trackedStrInfo = tracker.getData(trackedResult);
+
+        expect(notTrackedStrInfo).to.be.null;
+        expect(trackedStrInfo?.tags).to.deep.equal({ untrusted: [0, trackedStrInfo?.value.length - 1] });
+      });
+    });
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('foo');
+      const result = url.domainToASCII(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('foo');
+        const result = url.domainToUnicode(value);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+});